InfoSecBulletin Cybersecurity for mankind
Resecurity challenges the threat actor’s claims, asserting that the supposedly breached systems are not part of its real infrastructure but rather a honeypot intended to lure and observe the actors.
The company reported on December 24 that it first noticed a threat actor investigating its public systems on November 21, 2025.
Singapore Approves 200MW Data-Centre Expansion Under Second Call
Chameleon SEO Poisoning
Hackers poison Bing and Google search results to deliver phishing banking pages
Mysterious AI model “Ox Alpha” with free 100 trillion tokens a day for coders
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
The company filled the honeypot with fake datasets that mimic real business data, including over 28,000 synthetic consumer records and more than 190,000 synthetic payment transaction records, all created using Stripe’s official API format.
Resecurity reports that a threat actor started automating data theft in December, making over 188,000 requests from December 12 to December 24 with many residential proxy IP addresses.
Update: ShinyHunters says they were not involved in this activity as reported by Bleepingcomputer.
